[MODEL] New safeguards are unreasonably strict and prevents me from working on reasonable use cases + typeform for exemption not working

[787-10]

Preflight Checklist

• I have searched existing issues for similar behavior reports
• This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude refused a reasonable request

What You Asked Claude to Do

I asked claude to explore a codebase that I am building on top of in the aerospace/robotics domain. Every time I do this, it triggers a very strict filter that runs each exploration agent until completion, and I am unable to contineu the session.

Additionally, I am not a member of the cybersecurity exemption program, but whenever I click on the link in claude to access it, the typeform refuses to load on multiple browsers.

The safeguards that the model is using are unreasonably strict. This issue never happened before today even when working on similar projects in my domain.

What Claude Actually Did

Claude ran every agent towards completion and would then offer the following message: API Error: Opus 4.8's safeguards flagged this message for a cybersecurity topic.

Expected Behavior

Completed code exploration and entered plan mode

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

No response

Claude Model

Opus

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.197

Platform

Anthropic API

Additional Context

No response

[github-actions]

Found 3 possible duplicate issues:

1. False positive: API safeguards block legitimate security code reviews via custom subagents [skip-publish-guard] #72256
2. [Bug] Legitimate open source development tasks incorrectly blocked by Cyber Safeguards (False Positive) #66782
3. [Bug][cyber] ClAudit false-positive in DJI — req_011CcUDY4dMjWrzVBGYbJHco #71835

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[787-10]

This issue is not a duplicate of any of the above issues.

[ibodillakhodja-wq]

False positives on legitimate defensive cybersecurity work (Fable 5 auto-switch to Opus 4.8)

I'm an IT infrastructure and security administrator for a large government organization (~10,000 users). My routine daily work is defensive (blue-team) security operations: Suricata IDS/IPS rule tuning, ModSecurity/nginx WAF configuration, Wazuh SIEM alert triage, iptables/pfSense firewall audits, CrowdSec and fail2ban management, network equipment configuration.

Fable 5's safeguards repeatedly flag this routine work and auto-switch the session to Opus 4.8. The flagged task in my case: analyzing Wazuh alerts and Suricata zeek/crowdsec rules.

This is standard infrastructure hardening — no exploit development or offensive tooling was requested. The mid-session model switch disrupts long agentic tasks and makes behavior inconsistent.

Suggestions:

1. Tune the classifier to distinguish defensive operations (detection rule authoring, alert/log analysis, hardening, config review) from offensive requests.
2. The cybersecurity exemption program signup form (Typeform) fails to load for many users — see claude-code GitHub issue [MODEL] New safeguards are unreasonably strict and prevents me from working on reasonable use cases + typeform for exemption not working #72852.
3. Consider a project-level config flag to declare a security-operations context.

Otherwise Fable 5 is excellent for this work — the safeguard tuning is the only blocker.